BeyondTrust shipped its BT26-05 patch to customers on 8 October 2026 and fixed all Remote Support SaaS instances by 9 October. It then published the advisory for CVE-2026-102764 on 15 October, seven days after the patch. That gap, patch first and details a week later, is a small example of a coordinated disclosure timeline in practice. Third parties reported exploitation, but BeyondTrust's advisory does not itself make that claim.
What's affected
Anyone who writes a VDP and has to pick a number. The common choices differ in when the clock starts and what happens at the end.
| Policy | Default | Notes |
|---|---|---|
| Google Project Zero | 90 days to patch, then details 30 days after the patch | A patch on day 47 leads to disclosure on day 77; a grace period is possible |
| Project Zero, exploited in the wild | 7 days | The 30 day window still applies if patched by day 7 |
| CERT/CC (as described in the OpenSSF guide) | 45 days after the report, even without a fix | Exceptions exist |
| Linux distros list (via OpenSSF guide) | Under 7 days preferred | Absolute maximum of 14 days |
| GitHub and OpenSSF guidance for maintainers | 90 days | Described as the industry standard |
| EU CRA Article 14 | 24 hours early warning, 72 hours notification | Only for actively exploited vulnerabilities; final report within 14 days after a fix or mitigation |
The OpenSSF guide also advises treating declared timeframes as a starting point for negotiation, and notes that withholding exploit details helps only for a few days, because attackers can often infer the attack from the patch.
What to do now
- Pick a default for your own policy. For a small vendor, 90 days is common and defensible. Write it as an aim and say you will tell the reporter if you need longer.
- Say when the clock starts: at your acknowledgment of the report, not the researcher's first attempt.
- Add an exception for active exploitation. If an attacker is using the bug, shorten the timeline and say so.
- Decide your embargo notice: how many working days before disclosure downstream users, partners or distros hear. The OpenSSF guide suggests 1 to 30 working days depending on severity and patch complexity.
- Release patches and advisories together. Prefer Monday to Wednesday.
Click through how new advisories are tracked in practice.
Click through it at your own pace, or open it full screen.
Quick check
Under Project Zero's 90+30 policy, a vendor patches on day 47. When do details go public?
On day 77, which is 30 days after the patch.
